From 3c2c166fa67bf074834941e9729088e51b1269a2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thibault=20Delavall=C3=A9e?= Date: Wed, 29 Mar 2017 15:50:54 +0200 Subject: [PATCH] [FIX] mail: do not sudo access action fetch in /mail/view Otherwise it is impossible to know the user trying to access the record. This leads to some incoherent redirection. --- addons/mail/controllers/main.py | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/addons/mail/controllers/main.py b/addons/mail/controllers/main.py index 766fb9d5078..de58beed4cd 100644 --- a/addons/mail/controllers/main.py +++ b/addons/mail/controllers/main.py @@ -65,7 +65,20 @@ class MailController(http.Controller): if not record_sudo: # record does not seem to exist -> redirect to login return cls._redirect_to_messaging() - record_action = record_sudo.get_access_action() + + # the record has a window redirection: check access rights + if uid is not None: + record = record_sudo.sudo(uid) + if not RecordModel.sudo(uid).check_access_rights('read', raise_exception=False): + return cls._redirect_to_messaging() + try: + record_sudo.sudo(uid).check_access_rule('read') + except AccessError: + return cls._redirect_to_messaging() + else: + record_action = record.get_access_action() + else: + record_action = record_sudo.get_access_action() # the record has an URL redirection: use it directly if record_action['type'] == 'ir.actions.act_url': @@ -74,15 +87,6 @@ class MailController(http.Controller): elif not record_action['type'] == 'ir.actions.act_window': return cls._redirect_to_messaging() - # the record has a window redirection: check access rights - if uid is not None: - if not RecordModel.sudo(uid).check_access_rights('read', raise_exception=False): - return cls._redirect_to_messaging() - try: - record_sudo.sudo(uid).check_access_rule('read') - except AccessError: - return cls._redirect_to_messaging() - url_params = { 'view_type': record_action['view_type'], 'model': model,